projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 54bf7fa) | patch
integrity: Do not load MOK and MOKx when secure boot be disabled
authorLee, Chun-Yi <joeyli.kernel@gmail.com>
Sat, 18 Dec 2021 02:09:05 +0000 (10:09 +0800)
committerMimi Zohar <zohar@linux.ibm.com>
Fri, 24 Dec 2021 15:25:24 +0000 (10:25 -0500)
commit92ad19559ea9a8ec6f158480934ae26ebfe2c14f
tree7cab118eacabaecc222cbc63040de48a016005eetree | snapshot
parent54bf7fa3efd08eea03e4bac04e188ee3db6173a7commit | diff
integrity: Do not load MOK and MOKx when secure boot be disabled

The security of Machine Owner Key (MOK) relies on secure boot. When
secure boot is disabled, EFI firmware will not verify binary code. Then
arbitrary efi binary code can modify MOK when rebooting.

This patch prevents MOK/MOKx be loaded when secure boot be disabled.

Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
security/integrity/platform_certs/load_uefi.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git